Create an account and invite your team

This page covers the account delivered with your instance, how sign-in works, how to invite colleagues and which roles you can give them.

The first administrator account

Your instance ships with one administrator account, created by the Ctadel team when the instance is delivered. Its address is admin@<your subdomain> and its password is handed to you together with the instance address. The account holds the "Global Admin" role and its address is already marked as verified.

If you delete it or remove its role once your own administrators exist, it is not recreated.

Change its password at the first sign-in, using the reset procedure described below.

Signing in

Sign-in on the /login page happens in two steps.

1. Enter your "Email" and "Password", then "Sign in".
2. Ctadel emails a six-digit code to your address. Enter it under "Verification Code", then "Verify".

The code is valid for ten minutes. The fifth wrong code invalidates it; "Resend code" issues a new one. No session exists until the code has been accepted.

Passwords are at least twelve characters long. Attempts are limited: ten sign-ins per fifteen minutes from one IP address, twenty per account.

A session expires after twelve hours by default. The Ctadel team sets this value on your instance, between one hour and seven days.

Inviting colleagues

Invitations are sent from "Settings", tab "Users & Access", sub-tab "Users". The "Create" permission of the "Users" domain is required; the "Global Admin" role has it.

1. Click "Invite User".
2. Enter the colleague's "Email".
3. Under "Role Assignments", pick a role. An invitation carries a single role; more can be added once the account exists.
4. Click "Send Invitation".

An invitation is valid for seven days. It is listed under "Pending Invitations" with its expiry; you can send it again ("Resend invitation", which issues a new link) or cancel it. A new invitation to the same address replaces the previous one. An address that already has an account is refused.

The colleague receives an email titled "Invitation to join Ctadel". The link opens the "Join Ctadel" page, which states the assigned role. They fill in their "Full name", a "Password" of at least twelve characters and its confirmation, then click "Create my account". Their address counts as verified, a welcome email is sent and they can sign in.

If the colleague is already signed in to Ctadel with another account when opening the link, the page offers "Sign out and continue".

To change a member's roles, open their row under "Team Members": the "Edit Assignments" dialog lets you "Add Assignment" and then "Save Assignments". Deleting a user is permanent and asks for confirmation.

Roles and what they allow

Three system roles exist when the instance is created. Their permissions can be edited, but they cannot be renamed or deleted.

Role	What it allows
Global Admin	Every permission: read and change everything, manage users, roles, settings and single sign-on.
Global SecurityEngineer	Read everything; update findings and resources; create and update policies; start scans; saved queries; comments; ignore rules. No management of users, roles or settings.
Global Viewer	Read-only access to everything: dashboards, findings, inventory, graph, users, roles and settings.

You can create your own roles in the "Roles" sub-tab, button "Create Role": a "Name", a "Description", a "Project scope" ("All projects (global)" or one project) and, optionally, "Folders". "Permissions" are ticked by domain (Resources, Issues, Policies, Scans, Users, Roles, Settings, Graph, Saved Queries) and by action (Read, Create, Update, Delete). The "Copy Admin", "Copy SecurityEngineer" and "Copy Viewer" buttons prefill the selection.

A role scoped to a project or a folder only grants access to the cloud accounts in that scope. A user holding several roles picks the active one from the user menu, entry "Switch Role"; the permissions applied are those of that role on the displayed project. See Projects and folders.

Verifying your address

Accounts created through an invitation, and the first administrator, already have a verified address. In other cases, open "Preferences" from the user menu: the "Email verification" section shows the state of the address and the "Send verification link" button. The link is valid for twenty-four hours.

Resetting a password

1. On the sign-in page, click "Forgot password?".
2. Enter your "Email", then "Send reset link". The answer is the same whether the address exists or not.
3. Open the email titled "Reset your password". The link is valid for twenty-four hours and works once; a new request cancels the previous link.
4. On the "New password" page, enter a password of at least twelve characters and its confirmation, then "Reset password".

Sessions opened before the reset are revoked. Requests are limited to five per fifteen minutes per IP address, and five per hour for one email address. An account that signs in through single sign-on receives no link: its password is managed by your identity provider.

Preferences

The application language is chosen from the user menu, entry "Language": French or English. The choice is kept in your browser and saved on your account; the emails Ctadel sends you afterwards (sign-in code, reset, verification) follow that language. The same menu offers the interface "Theme" ("Light", "Dark" or "System").

The "Preferences" page shows your "Name" and "Email", the verification state of the address and a link to the notification settings. Alert channels (email, team messaging) and their rules are configured under "Settings", tab "Notifications"; see Notifications.

A summary email can be sent to global administrators at the end of each full scan: "Settings", tab "General", option "Email when a full scan completes". It is off by default.

Limitations

• The one-time code is sent by email. There is no code from an authenticator application and no hardware security key.
• The invitation email and the welcome email are sent in English, whatever the language of the inviting administrator. Later emails follow the language the user picked.
• An invitation carries one role; further roles are assigned after the account is created.
• The email address of an account cannot be changed from the interface.
• The name and the password are not edited from "Preferences"; the password goes through the reset procedure.